Refresh the dirtyfrag backport to upstream v5 and add the cifs.spnego
hardening patch.
1102-net-skbuff-propagate-shared-frag-marker.patch
Refreshed from upstream v3 to v5
(https://lore.kernel.org/all/ageeJfJHwgzmKXbh@v4bel/). The v5
series adds two skb_segment() hunks on top of v3: it folds
frag_skb-> flags into nskb on the per-iteration flag merge, and
fills the marker again when the inner switch rebinds frag_skb to
a list_skb on head_skb-frags exhaustion. The other v5 site
(tcp_clone_payload()) does not exist in 5.14 and is omitted.
skb_try_coalesce() hunk is retained as in v3/v4 because the
upstream commit that dropped it (f84eca581739) is only partially
backported in 5.14 -- its skb_split() half is present, but the
skb_try_coalesce() half is missing.
1105-smb-client-reject-userspace-cifs.spnego-descriptions.patch
Upstream commit 3da1fdf4efbc verbatim. Refuses userspace-created
cifs.spnego keys via request_key(2)/add_key(2); only kernel CIFS
using the private spnego_cred may create them. cifs.upcall
treats the key description as kernel-originating
pid/uid/creduid/upcall_target -- without this fence, userspace
can spoof those fields.
All four patches verified to apply with patch -p1 -F0 against the
5.14.0-687.5.1.el9_8 source tree (no fuzz, no rejects).
===================
The Kernel dist-git
===================
The kernel is maintained in a `source tree`_ rather than directly in dist-git.
The specfile is maintained as a `template`_ in the source tree along with a set
of build scripts to generate configurations, (S)RPMs, and to populate the
dist-git repository.
The `documentation`_ for the source tree covers how to contribute and maintain
the tree.
If you're looking for the downstream patch set it's available in the source
tree with "git log master..ark-patches" or
`online`_.
Each release in dist-git is tagged in the source repository so you can easily
check out the source tree for a build. The tags are in the format
name-version-release, but note release doesn't contain the dist tag since the
source can be built in different build roots (Fedora, CentOS, etc.)
.. _source tree: https://gitlab.com/cki-project/kernel-ark.git
.. _template: https://gitlab.com/cki-project/kernel-ark/-/blob/os-build/redhat/kernel.spec.template
.. _documentation: https://gitlab.com/cki-project/kernel-ark/-/wikis/home
.. _online: https://gitlab.com/cki-project/kernel-ark/-/commits/ark-patches
Andrew Lukoshko
53ec6c7fe3